Vulnerability · Published Jan 13, 2025 · Assigned by mitre

CVE-2024-46310

Critical 9.1

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)2.6%top 14.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Incorrect Access Control in Cfx.re FXServer v9601 and earlier allows unauthenticated users to modify and read arbitrary user data via exposed API endpoint

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-281 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/PRX5Y/CVE-2024-46310